python之如何让用户只删除他们在 Django 中创建的对象

他们可以通过放置帖子 ID 来绕过链接。不知道怎么解决。

/borrar/id

模板按钮:

{% if user == post.user %} 
    <a class="close pull-right" href="{% url 'post_borrar' post.id %}"><span aria-hidden="true">&times;</span></a> 
{% endif %} 

模板帖子/posts_mod_borrar.html:

<form method="post"> 
    {% csrf_token %} 
    ¿Estás seguro que deseas borrar el post "{{ object }}"? 
    <input type="submit" value="Submit" /> 
</form> 

View .py

class PostDeleteView(generic.DeleteView): 
    model = Post 
    template_name = 'posts/posts_mod_borrar.html' 
    success_url = reverse_lazy('timeline') 

模型.py

class Post(models.Model): 
    user = models.ForeignKey(User, on_delete=models.CASCADE) 
    texto = models.CharField(max_length=200) 
    imagen = models.ImageField(upload_to='posts', blank=True) 
    video = models.URLField(blank=True) 
    creado = models.DateTimeField(auto_now_add=True) 
    actualizado = models.DateTimeField(auto_now=True) 
 
class Meta: 
    ordering = ["-creado"] 
 
def __str__(self): 
    return self.texto 

请您参考如下方法:

你可以检查 obj.user 是否是 dispatch 方法中的 request.user:

from django.core.exceptions import PermissionDenied 
 
class PostDeleteView(generic.DeleteView): 
    ... 
 
    def user_passes_test(self, request): 
        if request.user.is_authenticated(): 
            self.object = self.get_object() 
            return self.object.user == request.user 
        return False 
 
    def dispatch(self, request, *args, **kwargs): 
        if not self.user_passes_test(request): 
            raise PermissionDenied 
        return super(PostDeleteView, self).dispatch( 
            request, *args, **kwargs) 

如果用户没有通过 user_passes_test PermissionDenied 将被引发